JP6878451B2 - Asynchronous analysis of data stream - Google Patents

Description

The present invention relates to the processing of data in a telecommunications network, and in particular to the analysis of streams moving to / from a client.

More precisely, the present invention relates to data stream monitoring and filtering applications, for example for Internet streams.

In the following, a data stream is, for example, on an internet-type network, between a client and an entity, that is, between a client and a server, or between two clients (so-called peer-to-peer, or P2P stream). Means any set of data to be exchanged.

Adopted for data formats, or their transmission, for the purpose of filtering data streams, classifying streams so that quality of service QoS can be configured in the network, or more generally processing data streams. It is known to apply various data stream classification schemes to detect the protocol.

To this end, network access points located in public locations, such as hospitals or university campuses, such as Wi-fi stations, may have stream analyzers intercepted-wise. is there. In fact, in hospitals or university campuses, it may be desirable to prevent P2P data streams, and therefore such data streams need to be detected.

Such a data stream analyzer intercepts packets in the data stream and the packets are processed to attempt to classify the stream.

Statistical and deterministic algorithms (also known as "Deep Packet Inspection" or DPI) are well known and are used to exchange data or transmit them based on intercepted data packets. Determining the format of a protocol, or more generally, whether a data stream is an allowed stream, or whether specific QoS should be applied to this stream, depending on the category to which it is assigned. Allows you to put the data stream into a category to infer whether or not.

EP1722509

However, analysis of packets in the data stream introduces a delay when the stream analyzer is being intercepted in the telecommunications network, and each packet received by the analyzer is processed and retained during the processing applied by the analyzer. ..

Packet analysis may allow you to classify the streams that correspond to the processed packets. In this case, the packet is retained if the stream is forbidden, forwarded if the stream is allowed, or the QoS policy is applied to the stream that corresponds to the packet. If the analysis of the packet is not sufficient to classify the stream, the packet will be forwarded when the analysis is complete.

Therefore, each data packet is retained during its analysis, thereby providing latency to the network. Moreover, since the analysis duration is variable (several milliseconds to a few tenths of a second), latency is not guaranteed to the client at all, which is unsatisfactory.

Therefore, it is necessary to effectively analyze the client's data stream while guaranteeing the minimum latency of the client.

The present invention remedies this situation.

To this end, the present invention is a method for processing a data stream exchanged between a client and an entity over a telecommunications network, wherein the data stream comprises a set of data packets. But,
--When intercepting a data packet belonging to a data stream, it is the step of copying the data packet or generating a reference to the data packet and forwarding the data packet to the recipient, where the data stream connects the source and the recipient. Including, the step and the client is the source or receiver of the data stream,
--The steps to send a copy or reference of the above to a stream analyzer that can analyze the data stream,
--The step of receiving the analysis result of the data stream from the stream analyzer,
--Propose a method that includes steps to process the data stream based on the received analysis results.

An entity means any entity capable of exchanging a data stream with a client, which may be, for example, another client or server.

The analysis result means any classification of the data stream into a given category, or any inference of the characteristics of the data stream. This result may be obtained by analysis of a single packet in the stream, or alternatively, analysis of several packets in the stream may be required. The processing of the stream may be based on a set of rules that take the analysis result as input and indicate the processing related to this analysis result.

If the stream analyzers and entities performing the method according to the invention share the same memory space, a reference to the data packet (such as the storage address of the packet in memory) is sufficient for the stream analyzer to analyze the packet. is there. In this case, the packet is forwarded to the recipient on the one hand and stored in memory on the other hand until the stream analyzer and the entity performing the method complete their respective processing of the packet. The order of completion is of little importance. Therefore, in some cases, the packet may have already been sent to the recipient, even though it has been stored in memory because its processing by the stream analyzer has not been completed. The generation of such references makes it possible to prevent stream analyzers and entities implementing the methods according to the invention from unnecessarily copying data packets when they share the same memory space. Unnecessary consumption of software resources required to copy data packets is thus avoided.

Furthermore, if the analysis of the stream is based on a copy of the data packet or a reference to the data packet, it is advantageous to have the stream because the data packet does not need to be retained while each packet is being analyzed. It is possible to reduce the latency associated with the analysis. Correspondingly, if the process is to allow or ban the stream, data packets that may belong to the banned stream will be sent to the recipient, but in practice some of the banned streams. Passing data packets is not harmful, especially in situations where some types of streams (eg, P2P streams) are required to be banned. If the process is to apply a quality of service policy according to the analysis result, the quality of service policy is correspondingly implemented only when the analysis result is received. However, this only prevents quality of service from being applied to the first packet corresponding to the video conferencing, for example, in the most pessimistic scenarios, which is harmless to the user.

The method can further include a time delay step of predetermined duration D following copying the data packet or generating a reference.
--If the stream analysis result is received from the stream analyzer and the data stream is allowed, or
--Data packets can be forwarded to the recipient at the expiration of the time delay only if the stream analysis results have not yet been received from the stream analyzer.

In this way, it is possible and at the same time guaranteed to limit the risk of forwarding data packets in a forbidden stream or to prevent forwarding packets to which a given quality of service policy should apply. It ensures maximum latency, which is advantageous in the context of data streams such as Internet streams.

As a variant, the data packet can be instantly forwarded to the recipient after being copied or after generating a reference.

When the reference is forwarded to the stream analyzer and when the data packet is forwarded to the recipient, the data packet is also stored in the memory of the entity performing the method. This memory is made available to the stream analyzer to access the packet by the received reference.

Therefore, the filtering method is transparent in terms of latency according to this embodiment.

In one embodiment, the step of processing the data stream is
--Steps to apply quality of service policy depending on received analysis results, or
--Can include steps to allow or disallow data streams based on received analysis results.

Of course, other processes can be considered, and the application of quality of service policies and stream filtering (permission or prohibition) are given only as examples.

Further, a predetermined duration D is such that for a set N of data streams, at least one predetermined portion k of the N data streams can be analyzed by the stream analyzer with an analysis duration less than D. Can be statistically determined.

Duration D thus means low latency and low risk of forwarding data packets of forbidden streams, or low risk of forwarding data packets that should have a quality of service policy applied. Optimized to ensure a compromise.

According to one embodiment of the invention, the steps of processing a data stream based on the received analysis
--A step of storing the marking of a data stream in the database, which can include a step indicating whether the stream is allowed or prohibited.

This method is used every time a data packet is intercepted.
--Steps to identify the data stream corresponding to the received packet,
--If the data packet corresponds to an allowed stream, the step of forwarding the data packet to the recipient,
--If the data packet corresponds to a banned stream, it can further include a step to block the data packet.

A second aspect of the invention relates to a computer program product, comprising instructions for performing the method according to the first aspect of the invention when the computer program product is executed by a processor. ..

A third aspect of the invention is a device for processing a data stream exchanged between a client and an entity over a telecommunications network, wherein the data stream comprises a set of data packets and is a processing device. But,
--An input interface for intercepting data packets belonging to the data stream,
--With the output interface
--A processor configured to intercept a data packet belonging to a data stream, copy the data packet, or generate a reference to the data packet, and forward the data packet to the recipient via the output interface. A device comprising a processor, wherein the data stream includes a source and a receiver, and a client is the source or receiver of the data stream.

The output interface can be further designed to send a copy to a stream analyzer that can analyze the data stream, and the input interface will receive the results of the analysis of the data stream from the stream analyzer. It can be further designed and the processor can be further designed to process the data stream based on the analysis results received.

The processor delays for a predetermined duration D, following copying the data packet or generating a reference,
--If the stream analysis result is received from the stream analyzer and the data stream is allowed, or
--It may even be possible to forward the data packet to the recipient at the expiration of the time delay only if the stream analysis result has not yet been received from the stream analyzer.

A fourth aspect of the present invention comprises a processing device according to a third aspect of the present invention and a stream analyzer capable of obtaining the results of analysis of a data stream based on one or more data packets of the data stream. Regarding the data stream processing system to be provided.

Other features and advantages of the present invention will become apparent upon examination of the description detailed below and the accompanying drawings.

It is a figure which shows the general architecture of the system by one Embodiment of this invention. It is a chart which presents the step of the processing method by one Embodiment of this invention. A curve showing the duration of analysis of various data streams. It is a figure which shows the structure of the data processing device by one Embodiment of this invention.

FIG. 1 shows a system according to an embodiment of the present invention.

The system may be a "client" in the following, such as a laptop or desktop computer, touch tablet, smartphone, or any electronic device with an interface that allows it to communicate with the access point 11 of a telecommunications network 14, such as the Internet. Includes the user terminal 10.

Access point 11 is not restricted and may be a wireless access point, such as a Wi-fi type, or a wire drink (eg ADSL or fiber).

For example, in the following, access point 11 is considered to be a Wi-fi station on campus. As explained in the introduction, users who access the Internet network via the access point on the university campus may want to prohibit P2P data streams.

Through the telecommunications network 14, the client 10 can request another client 16 (uplink), for example, to request multimedia content, or more simply to request the loading of an internet page, or by peer-to-peer communication protocol. Can communicate with the remote server 15 to exchange files (on and / or on the downlink). The present invention also realizes that the client 10 can upload multimedia content on the server 15.

The way in which communications are established and requests and responses are routed is well known and will not be presented in more detail below.

When communication is established between client 10 and server 15 or client 16, data streams are exchanged over telecommunications network 14. This data stream can carry out the exchange of data packets, such as TCP ("Transport Control Protocol") packets, when this transport protocol is adopted. However, there are no restrictions on the layer of protocol adopted for communication of data streams.

Such a data stream may be observed and intercepted by the processing device 12 according to an embodiment of the invention, which processing device 12 may be upstream or downstream of the access point 11 or processing device. 12 may be incorporated in the access point 11. For example, the university campus in the example considered above may be equipped with a single processing device 12.

The processing device 12 may be linked to a stream analyzer 13 responsible for analyzing packets in the data stream for the purpose of analyzing the data stream. In a variant, the stream analyzer 13 may be integrated into the processing device 12. The stream analyzer 13 and the processing device 12 may share one and the same memory, according to some embodiments.

Such a stream analyzer 13 itself is well known and is outside the scope of the present invention. For example, it would be possible to refer to the traffic analysis system of the patent application published under EP1722509.

In any case, the stream analyzer 13 can return the analysis results to a processing device 12 that can be used to process the data stream. For example, the analysis results may allow classification of data streams, for example, between groups of P2P data streams and groups of non-P2P data streams. Therefore, if the processing device 12 is dedicated to filtering, the processing device 12 may prohibit streams classified as P2P and allow streams classified as non-P2P. As a variant, stream classification may be used by the processing unit 12 to apply a differentiated QoS policy.

FIG. 2 is a chart showing the steps of a method for processing a data stream according to an embodiment of the present invention. The stream processing method can be implemented by the processing device 12 shown in FIG.

In the following, an example of data stream filtering will be considered as an example. The data stream can therefore be allowed or prohibited by the processing device 12. However, as detailed above, the present invention also applies to the application of QoS policies to data streams, and more generally to arbitrary data stream processing.

In step 201, the data packet is intercepted by the analysis device 12. As described above, data packets may be sent from or addressed to client 10.

In step 202, the data stream to which the data packet corresponds is identified. There are no restrictions on how the stream is identified. The stream identifier may include, for example, a source identifier and a receiver identifier. Client 10 is either the source or recipient of the identified stream.

In step 203, it is checked whether the identified stream was previously classified on the processing device 12 as a allowed stream or a prohibited stream.

If the stream has not been previously classified, the data packet is copied in step 204. A copy of the data packet is thus obtained and sent to the stream analyzer 13. As a variant, if the stream analyzer 13 and the processing device 12 share a common memory, step 204 is to generate a reference to the data packet.

The data packet is then sent in step 205 to the receiver of the stream (client 10 if client 10 is the receiver, server 15 or client 16 if client 10 is the source). If a reference is generated instead of a copy of the data packet, the data packet is further stored in memory until the completion of step 206 detailed below.

There are no restrictions on the order in which data packets and their copies (or references thereof) are forwarded, and the step arrangement in Figure 2 is given as an example.

By making the stream analysis a copy of the data packet or based on a reference, the data packet does not have to be held in processing unit 12 until the packet is analyzed, thus reducing the latency associated with stream analysis. It will be possible. Correspondingly, data packets that may belong to the prohibited stream are sent to the recipient. However, in practice, passing several data packets of a banned stream is not harmful, especially in situations where some type of stream (eg, P2P stream) is required to be banned.

When one or more copies or references of the data packet corresponding to the data stream are transferred to the stream analyzer 13 in step 206, the result of the analysis is received from the stream analyzer 13 in step 206. The duration required to obtain such results may not be known in advance and will vary depending on the data stream being analyzed. The duration of analysis of the data stream may be represented by curve 301, as shown in FIG.

The index of the data stream is expressed in abscissa and the duration of analysis of this data stream is expressed in ordinate. Curve 301 is obtained after analysis of N data streams, where N is hundreds or thousands of magnitudes. The data stream index is ranked as the analysis duration decreases. In practice, the resulting curve 301 is hyperbolic, i.e., a relatively small number of data streams require long analysis.

Upon receiving the results of the analysis from the stream analyzer 13 in step 207, the processing unit 12 can classify the data stream for the purpose of permitting or disallowing the data stream. The result of this classification is available in step 203 when a new data packet corresponding to the same data stream is received.

The processing unit 12 can take the analysis results as input and store a set of rules that classify the streams, that is, return either allowed or prohibited streams. In the particular example described above, the analysis results can indicate whether the data stream is a P2P stream, and only the P2P stream is classified as a stream prohibited by processing unit 12. The data stream classification (or data stream marking) may be stored in the database of processing unit 12 in association with the data stream identifier. As described above, the data stream identifier can include a recipient identifier (eg, an IP address, or a port number / IP address pair), and a source identifier.

Therefore, when it is determined in step 203 that the data stream corresponding to the received data packet is classified, the method is based on the category assigned to the data stream corresponding to the data packet in step 208. Including filtering
--If the data stream is allowed, for example, if the data stream is established between client 10 and server 15 on campus (non-P2P stream), the data packet will be immediately forwarded to the recipient.
--If the data stream is prohibited, for example, if the data stream is established between client 10 on campus and another client 16 (P2P stream), the data packet is blocked.

As described above, the data packet is transferred to the recipient in step 205 after being copied in step 204 (or after generating a reference). According to the first embodiment, the data packet is forwarded immediately in step 205 after being copied or generating a reference (the left branch of the output from block 204).

According to the second embodiment, after copying the data packet in step 204 or generating the reference, there may be a time delay in step 209 for a predetermined duration D (of the output from block 204). Right branch). At the completion of duration D, in step 210 it is determined whether the analysis result has been received. Otherwise, the data packet is forwarded to the recipient of the data stream in step 205.

If it is determined in step 210 that the analysis results have been received, then in step 211 it is checked whether the data stream is classified as an allowed stream. If so, the data packet is forwarded in step 205. Conversely, if the data stream is prohibited, the data packet is blocked in step 212.

Therefore, according to the second embodiment, all data packets are delayed by duration D unless the analysis result is received.

The duration D can be advantageously selected based on the curve 301 presented in FIG. For example, D can be the duration at which the analysis results can be obtained for at least k% of the data stream, eg 90%. _{D is therefore calculated so that the number N 1} shown in FIG. 3 represents one tenth of the total number N of possible data streams.

This makes it possible to ensure a fixed latency with a relatively small value, while at the same time prohibiting streams (since the analysis results will be taken at the completion of duration D at 90%). Reduces the risk of forwarding data packets belonging to.

FIG. 3 represents a processing device 12 according to an embodiment of the present invention.

The processing device 12 includes a random access memory 404 and a processor 403 to store instructions that allow the steps of the method described above with respect to FIG. 2 to be performed. The filtering device 12 also provides data that is intended to be stored after the application of the method, in particular as a data stream that is allowed or prohibited, or as a data stream that is differentiated by the QoS policy applied. It includes a database 405 for storing data for marking streams and rules that allow inferring stream classifications based on analysis results. The processing device 12 further comprises an input interface 401 intended to receive the data packets of the data stream exchanged via the access point 11 and to receive the results of the analysis of the stream analyzer 13. .. As a variant, different input interfaces may be provided, one dedicated to intercepting data packets exchanged via the access point and the other dedicated to receiving the results of the analysis of the stream analyzer 13.

The processing device 12 comprises an output interface 406 capable of sending a copy (or reference to the data packet) of the data packet to the stream analyzer 13 on the one hand and forwarding the data packet to the client 10 or network 14 on the other hand. A separate output interface may be provided, just as in the case of the input interface 401.

Of course, the present invention is not limited to the embodiments described above as an example, but also applies to other modifications.

10 User terminal / client
11 Access point
12 Processing device
13 Stream Analyzer
14 Telecommunications network
15 remote server
16 client
401 input interface
403 processor
404 random access memory
405 database
406 Output interface

Claims (6)

A method for processing a data stream exchanged between a client and an entity over a telecommunications network, wherein the data stream contains a set of data packets.
--When intercepting a data packet belonging to a data stream, it is a step of copying the data packet or generating a reference to the data packet and transferring the data packet to the receiver, wherein the data stream is the source. A step that includes said receiver and said client is said source or receiver of said data stream.
—— The step of sending the copy or reference to a stream analyzer that can analyze the data stream,
--The step of receiving the analysis result of the data stream from the stream analyzer,
--Including the step of processing the data stream based on the received analysis result.
The method further comprises a time delay step of predetermined duration D following the copying of the data packet or the generation of the reference.
--When the stream analysis result is received from the stream analyzer and the data stream is allowed, or
--The data packet is forwarded to the recipient at the expiration of the time delay only if the stream analysis result has not yet been received from the stream analyzer .
At least one predetermined portion k of the N data streams can be analyzed by the stream analyzer with an analysis duration of less than D for a set N of the data streams having the predetermined duration D. statistically determined Ru method as. The step of processing the data stream is
--Steps to apply quality of service policy according to the received analysis results, or
-The method of claim 1, which can include a step of allowing or disallowing the data stream based on the received analysis result. The step of processing the stream
—— A step of storing a marking of the data stream in a database, the marking comprising a step indicating whether the stream is allowed or prohibited.
Each time a data packet is intercepted, the above method
--The step of identifying the data stream corresponding to the received packet, and
—— If the data packet corresponds to an allowed stream, then the step of forwarding the data packet to the recipient.
-The method of claim 1 or 2 , further comprising blocking the data packet if the data packet corresponds to a banned stream. A non-temporary computer-readable storage medium , comprising instructions for performing the method according to any one of claims 1 to 3 , when the non-temporary computer-readable storage medium is executed by a processor. Non-temporary computer-readable storage medium . A device for processing a data stream exchanged between a client and an entity over a telecommunications network, wherein the data stream contains a set of data packets.
--An input interface for intercepting data packets belonging to the data stream,
--With the output interface
--A processor configured to intercept a data packet belonging to a data stream, copy the data packet, or generate a reference to the data packet, and forward the data packet to the recipient via the output interface. A processor, wherein the data stream includes a source and a receiver, and the client is the source or receiver of the data stream.
The output interface is further designed to send the copy or reference to a stream analyzer capable of analyzing the data stream.
The input interface is further designed to receive the results of analysis of the data stream from the stream analyzer.
The processor is further designed to process the data stream based on the received analysis results.
The processor is time-delayed for a predetermined duration D following copying the data packet or generating the reference.
--When the stream analysis result is received from the stream analyzer and the data stream is allowed, or
--The data packet can be transferred to the recipient at the expiration of the time delay only if the stream analysis result has not yet been received from the stream analyzer .
The processor causes the predetermined duration D by the stream analyzer with an analysis duration of at least one predetermined portion k of the N data streams less than D for a set N of data streams. Ru is designed to statistically determined to be analyzed,
device. A stream processing system comprising the processing device of claim 5 and a stream analyzer capable of acquiring the results of analysis of the data stream based on one or more data packets of the data stream.

Images